There are several options if no regex or value can be transformed/ replaced:



  1. Use untransformed values
    The values are processed as sent by the identity provider.

  2. Ignore the attribute
    The attribute will be ignored and not updated/ saved for this user.
    Existing values will not be changed.

  3. Clear the attribute value
    Only the attributes that could be transformed are assigned; all other values are removed.
    For example, the identity provider sends three groups: "A," "B," and "C." Only "C" is transformed, and "A" and "B" are removed.
    If the identity provider sends three groups, "A," "B," and "C," and no transformation applies to them, none will be assigned.

  4. Filter the user
    If no transformation rule is applied, the user will be filtered. In the context of SAML SSO, authentication for this user will fail.
    In the context of UserSync, the user will not be synced, or the cleanup behaviour will be applied if the user already exists.
    The below depicts a User Sync connector's Sync Settings tab with the cleanup behaviour, which is always applied only at the end of a full synchronization.